refactor: Rename sourcehub to remote/vera acp terminology

.github/composites/get-vera-image/action.yml

@@ -0,0 +1,51 @@
+# Copyright 2026 Democratized Data Foundation
+#
+# Use of this software is governed by the Business Source License
+# included in the file licenses/BSL.txt.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0, included in the file
+# licenses/APL.txt.
+
+name: 'Get Vera Docker Image Tag'
+
+description: 'Composite action to determine the Vera Docker image matching go.mod'
+
+outputs:
+  image:
+    description: "Vera image to use"
+    value: ${{ steps.image-name.outputs.image }}
+
+runs:
+  # This is a composite action, setting this is required.
+  using: "composite"
+
+  steps:
+    # Go pseudo-versions contain the short commit for the required Vera revision.
+    - name: Get Vera short commit
+      id: vera-commit
+      shell: bash
+      run: |
+        set -euo pipefail
+        VERA_COMMIT=$(sed -En \
+          's|^[[:space:]]*github.com/sourcenetwork/vera[[:space:]]+v[^[:space:]]+-([0-9a-f]+)[[:space:]]*$|\1|p' \
+          go.mod)
+        test -n "$VERA_COMMIT"
+        echo "short=$VERA_COMMIT" >> "$GITHUB_OUTPUT"
+
+    # Fetch Vera to resolve the short pseudo-version commit to its full SHA.
+    - name: Checkout Vera code into the directory
+      uses: actions/checkout@v6
+      with:
+        repository: sourcenetwork/vera
+        path: _vera
+        fetch-depth: 0
+
+    - name: Build Vera image name
+      id: image-name
+      working-directory: _vera
+      shell: bash
+      run: |
+        commit=$(git rev-parse "${{ steps.vera-commit.outputs.short }}^{commit}")
+        echo "image=ghcr.io/sourcenetwork/vera:sha-$commit" >> "$GITHUB_OUTPUT"

.github/workflows/test-coverage.yml

@@ -126,15 +126,15 @@ jobs:
             "
           coverage-path: coverage.txt
 
-  # The document acp matrix job tests the combinations of source-hub acp and client types on linux.
+  # The document ACP matrix job tests the combinations of document ACP types and client types on Linux.
   test-coverage-document-acp:
     name: Test coverage document acp job
 
     strategy:
       fail-fast: false
       matrix:
         client-type: [go, http, cli, c]
-        document-acp-type: [source-hub]
+        document-acp-type: [remote]
 
     runs-on: runs-on=${{ github.run_id }}-${{ github.run_attempt }}-${{ strategy.job-index }}/\
       spot=pco/cpu=16+32/family=c6*+c7*/disk=large/extras=s3-cache
@@ -158,14 +158,14 @@ jobs:
       - name: Setup defradb
         uses: ./.github/composites/setup-defradb
 
-      - name: Get SourceHub Docker Image Name
-        id: sourcehub-image
-        uses: ./.github/composites/get-sourcehub-image
+      - name: Get Vera Docker Image Name
+        id: vera-image
+        uses: ./.github/composites/get-vera-image
 
       - name: Test coverage & save coverage report in an artifact
         uses: ./.github/composites/test-coverage-with-artifact
         env:
-          DEFRA_SOURCEHUB_IMAGE: ${{ steps.sourcehub-image.outputs.image }}
+          DEFRA_VERA_IMAGE: ${{ steps.vera-image.outputs.image }}
         with:
           coverage-artifact-name: "coverage_document_acp\
             _${{ matrix.document-acp-type }}\

CONTRIBUTING.md

@@ -80,7 +80,7 @@ You don't need to be an expert in all of these to contribute - many contribution
 
 | Tool | When You Need It |
 |------|-----------------|
-| **[SourceHub](https://github.com/sourcenetwork/sourcehub)** | Working on access control features |
+| **[Vera](https://github.com/sourcenetwork/vera)** | Working on access control features |
 | **[Ollama](https://ollama.com/download)** | AI/vector embedding tests |
 | **[Make](https://www.gnu.org/software/make/)** | Convenient but not required - you can run `go` commands directly |
 

CONTRIBUTING_INTERNAL.md

@@ -28,7 +28,7 @@
   - [🔧 Quick Fix Checklist](#-quick-fix-checklist)
 - [🧪 Testing - Advanced](#-testing--advanced)
   - [🏃 Test Configuration Variables](#-test-configuration-variables)
-  - [🌐 SourceHub ACP Tests](#-sourcehub-acp-tests)
+  - [🌐 Remote Document ACP Tests](#-remote-document-acp-tests)
   - [📈 Benchmarks](#-benchmarks)
   - [🔍 Change Detector](#-change-detector)
 - [📦 Dependency Management](#-dependency-management)
@@ -188,18 +188,18 @@ The test suite uses environment variables to control which configurations are te
 | `DEFRA_BADGER_FILE` | `true`/`false` | Use file-based Badger store |
 | `DEFRA_BADGER_ENCRYPTION` | `true`/`false` | Enable Badger encryption |
 | `DEFRA_MUTATION_TYPE` | `gql` / `collection-named` / `collection-save` | Mutation type |
-| `DEFRA_DOCUMENT_ACP_TYPE` | `local` / `source-hub` | ACP type |
+| `DEFRA_DOCUMENT_ACP_TYPE` | `local` / `remote` | ACP type |
 | `DEFRA_LENS_TYPE` | `wasm-time` / `wasm-er` | Lens WASM runtime |
 | `DEFRA_VIEW_TYPE` | `cacheless` / `materialized` | View type |
 | `DEFRA_VECTOR_EMBEDDING` | `true`/`false` | Enable vector embedding tests |
 
-### 🌐 SourceHub ACP Tests
+### 🌐 Remote Document ACP Tests
 
 > [!WARNING]
-> SourceHub ACP tests require **Docker** and are resource-heavy.
+> Remote Document ACP tests use a Vera container, require **Docker**, and are resource-heavy.
 
 ```shell
-DEFRA_CLIENT_HTTP=true DEFRA_CLIENT_GO=false DEFRA_DOCUMENT_ACP_TYPE=source-hub \
+DEFRA_CLIENT_HTTP=true DEFRA_CLIENT_GO=false DEFRA_DOCUMENT_ACP_TYPE=remote \
   DEFRA_BADGER_MEMORY=true go test ./tests/integration/acp/... -count=1 -timeout 20m
 ```
 

Makefile

@@ -301,9 +301,9 @@ test\:gql-mutations:
 test\:col-named-mutations:
 	DEFRA_MUTATION_TYPE=collection-named DEFRA_BADGER_MEMORY=true gotestsum --format pkgname -- $(DEFAULT_TEST_DIRECTORIES)
 
-.PHONY: test\:source-hub
-test\:source-hub:
-	DEFRA_DOCUMENT_ACP_TYPE=source-hub gotestsum --format pkgname -- $(DEFAULT_TEST_DIRECTORIES)
+.PHONY: test\:remote-dac
+test\:remote-dac:
+	DEFRA_DOCUMENT_ACP_TYPE=remote gotestsum --format pkgname -- $(DEFAULT_TEST_DIRECTORIES)
 
 .PHONY: test\:go
 test\:go:

README.md

@@ -11,7 +11,7 @@
   </picture>
 </p>
 
-DefraDB is a zero-trust database that prioritizes data verifiability, privacy, and information security. Its data model, powered by the convergence of [MerkleCRDTs](https://arxiv.org/pdf/2004.00107.pdf) and the content-addressability of [IPLD](https://docs.ipld.io/), enables a multi-write-master architecture. It features [DQL](https://docs.source.network/defradb/references/query-specification/query-language-overview), a query language compatible with GraphQL but providing extra convenience. By leveraging peer-to-peer networking it can be deployed nimbly in novel topologies. Access control is determined by a relationship-based DSL, supporting document or field-level policies, secured by the SourceHub network. DefraDB is a core part of the [Source technologies](https://source.network/) that enable new paradigms of decentralized data and access-control management, user-centric apps, data trustworthiness, and much more.
+DefraDB is a zero-trust database that prioritizes data verifiability, privacy, and information security. Its data model, powered by the convergence of [MerkleCRDTs](https://arxiv.org/pdf/2004.00107.pdf) and the content-addressability of [IPLD](https://docs.ipld.io/), enables a multi-write-master architecture. It features [DQL](https://docs.source.network/defradb/references/query-specification/query-language-overview), a query language compatible with GraphQL but providing extra convenience. By leveraging peer-to-peer networking it can be deployed nimbly in novel topologies. Access control is determined by a relationship-based DSL, supporting document or field-level policies, secured by the Vera network. DefraDB is a core part of the [Source technologies](https://source.network/) that enable new paradigms of decentralized data and access-control management, user-centric apps, data trustworthiness, and much more.
 
 Read the documentation on [docs.source.network](https://docs.source.network/).
 

acp/dac/bridge.go

@@ -22,14 +22,17 @@ import (
 	acpTypes "github.com/sourcenetwork/defradb/acp/types"
 )
 
-var _ acp.ACPSystemClient = (*SourceHubDocumentACP)(nil)
+var _ acp.ACPSystemClient = (*RemoteDocumentACP)(nil)
 
 var _ DocumentACP = (*bridgeDocumentACP)(nil)
 
 // bridgeDocumentACP wraps an [ACPSystemClient], hosting the DefraDB specific logic away
 // from ACP client specific code.
 type bridgeDocumentACP struct {
 	clientACP acp.ACPSystemClient
+	// documentACPType must only be set to [acpTypes.LocalDocumentACP] or
+	// [acpTypes.RemoteDocumentACP]. [acpTypes.NodeACP] and future NAC types are invalid.
+	documentACPType acpTypes.ACPSystemType
 }
 
 func (a *bridgeDocumentACP) Start(ctx context.Context) error {
@@ -57,7 +60,7 @@ func (a *bridgeDocumentACP) AddPolicy(ctx context.Context, creator identity.Iden
 	)
 
 	if err != nil {
-		return "", acp.NewErrFailedToAddPolicy(err, "Local", creator.DID())
+		return "", acp.NewErrFailedToAddPolicy(err, a.documentACPType.String(), creator.DID())
 	}
 
 	log.InfoContext(ctx, "Created Policy", corelog.Any("PolicyID", policyID))
@@ -69,29 +72,18 @@ func (a *bridgeDocumentACP) ValidateResourceInterface(
 	policyID string,
 	resourceName string,
 ) error {
-	var err error
-	switch a.clientACP.(type) {
-	case *LocalDocumentACP:
-		err = acp.ValidateResourceInterface(
-			ctx,
-			policyID,
-			resourceName,
-			acpTypes.LocalDocumentACP,
-			a.clientACP,
-		)
-	case *SourceHubDocumentACP:
-		err = acp.ValidateResourceInterface(
-			ctx,
-			policyID,
-			resourceName,
-			acpTypes.SourceHubDocumentACP,
-			a.clientACP,
-		)
-	default:
+	if a.documentACPType != acpTypes.LocalDocumentACP &&
+		a.documentACPType != acpTypes.RemoteDocumentACP {
 		return acp.ErrInvalidACPSystem
 	}
 
-	return err
+	return acp.ValidateResourceInterface(
+		ctx,
+		policyID,
+		resourceName,
+		a.documentACPType,
+		a.clientACP,
+	)
 }
 
 func (a *bridgeDocumentACP) RegisterDocObject(
@@ -117,7 +109,14 @@ func (a *bridgeDocumentACP) RegisterDocObject(
 		if ownerErr == nil && owner.HasValue() && owner.Value() == identity.DID() {
 			return nil
 		}
-		return acp.NewErrFailedToRegisterDoc(err, "Local", policyID, identity.DID(), resourceName, docID)
+		return acp.NewErrFailedToRegisterDoc(
+			err,
+			a.documentACPType.String(),
+			policyID,
+			identity.DID(),
+			resourceName,
+			docID,
+		)
 	}
 
 	return nil
@@ -136,7 +135,13 @@ func (a *bridgeDocumentACP) IsDocRegistered(
 		docID,
 	)
 	if err != nil {
-		return false, acp.NewErrFailedToCheckIfDocIsRegistered(err, "Local", policyID, resourceName, docID)
+		return false, acp.NewErrFailedToCheckIfDocIsRegistered(
+			err,
+			a.documentACPType.String(),
+			policyID,
+			resourceName,
+			docID,
+		)
 	}
 
 	return maybeActor.HasValue(), nil
@@ -169,7 +174,7 @@ func (a *bridgeDocumentACP) CheckDocAccess(
 			if err != nil {
 				return false, acp.NewErrFailedToVerifyDocAccess(
 					err,
-					"Local",
+					a.documentACPType.String(),
 					permissionThatImpliesRead.String(),
 					policyID,
 					actorID,
@@ -198,7 +203,7 @@ func (a *bridgeDocumentACP) CheckDocAccess(
 	if err != nil {
 		return false, acp.NewErrFailedToVerifyDocAccess(
 			err,
-			"Local",
+			a.documentACPType.String(),
 			permission.String(),
 			policyID,
 			actorID,
@@ -253,7 +258,7 @@ func (a *bridgeDocumentACP) AddDocActorRelationship(
 	if err != nil {
 		return false, acp.NewErrFailedToAddDocActorRelationship(
 			err,
-			"Local",
+			a.documentACPType.String(),
 			policyID,
 			resourceName,
 			docID,
@@ -321,7 +326,7 @@ func (a *bridgeDocumentACP) DeleteDocActorRelationship(
 	if err != nil {
 		return false, acp.NewErrFailedToDeleteDocActorRelationship(
 			err,
-			"Local",
+			a.documentACPType.String(),
 			policyID,
 			resourceName,
 			docID,

acp/dac/dac.go

@@ -46,7 +46,7 @@ type DocumentACP interface {
 	// by assuming YAML format if JSON validation fails. Upon success a policyID is returned,
 	// otherwise returns error.
 	//
-	// A policy can not be added without a creator identity (sourcehub address).
+	// A policy cannot be added without a creator identity (a Vera address for Remote DAC).
 	AddPolicy(ctx context.Context, creator identity.Identity, policy string) (string, error)
 
 	// ValidateResourceInterface performs resource interface validation of the linked/matching

acp/dac/doc.go

@@ -9,10 +9,10 @@
 // licenses/APL.txt.
 
 /*
-This package implements local and sourcehub document access control systems.
+This package implements Local and Remote Document Access Control (DAC) systems.
 
-Local document access control provides acp local to a node.
+Local DAC provides access control local to a node.
 
-SourceHub document access control enables acp beyond just the local node.
+Remote DAC, backed by Vera, provides access control shared across nodes.
 */
 package dac

acp/dac/local.go

@@ -13,13 +13,14 @@ package dac
 import (
 	"github.com/sourcenetwork/defradb/acp"
 	"github.com/sourcenetwork/defradb/acp/local"
+	acpTypes "github.com/sourcenetwork/defradb/acp/types"
 )
 
 const localStoreName = "local_document_acp"
 
 var _ acp.ACPSystemClient = (*LocalDocumentACP)(nil)
 
-// LocalDocumentACP represents a local document acp implementation that makes no remote calls.
+// LocalDocumentACP represents the Local DAC implementation, which makes no remote calls.
 type LocalDocumentACP struct {
 	*local.LocalACP
 }
@@ -31,6 +32,7 @@ func NewLocalDocumentACP(pathToStore string) (DocumentACP, error) {
 	}
 
 	return &bridgeDocumentACP{
-		clientACP: &LocalDocumentACP{LocalACP: localACP},
+		clientACP:       &LocalDocumentACP{LocalACP: localACP},
+		documentACPType: acpTypes.LocalDocumentACP,
 	}, nil
 }